Qilin

The Qilin ransomware group, a malicious threat actor in the cybersecurity landscape, has been active since at least 2022 and gained significant attention in June 2024 for attacking Synnovis, a UK governmental service provider for healthcare. The group was later associated with Octo Tempest, which added Qilin ransomware to its arsenal, thereby expanding its capabilities for cyberattacks. Qilin's activities have evolved over time, demonstrating increasingly sophisticated tactics such as rebooting infected machines in safe mode to bypass security tools, indicating an escalating threat level. In July 2024, Sophos' Incident Response team observed Qilin's activity on a domain controller within an organization's Active Directory domain. The operators of Qilin leveraged a Group Policy Object (GPO) to execute a script each time a user logged into an endpoint. This strategy resulted in different impacts on various domain controllers within the same network. Qilin also targeted the network assets of organizations and stole credentials stored in Google Chrome browsers from compromised endpoints, further highlighting their evolving strategies. One of the most significant attacks attributed to Qilin was on the automotive giant Yanfeng. Victims of this variant of Qilin ransomware attack were advised to reset all Active Directory passwords and warn users to change passwords for sites saved in their Chrome browsers. As the Qilin group continues to expand its repertoire of techniques and changes its tactics, organizations are urged to remain vigilant and reinforce their cybersecurity defenses to counter these emerging threats.